The draft Investigatory Powers Bill contains provisions for the intelligence services to generate and examine ‘Bulk Personal Datasets’ (BPDs) in order to obtain intelligence about threats to national security, prevent serious crime, and safeguard the economic well-being of the UK. Open avowal of the use of such datasets, which contain many innocent people’s information, marks a significant change from the strict ‘Neither Confirm Nor Deny’ position that the Government adopted in response to legal challenges to the issue during hearings before the Investigatory Powers Tribunal in 2014 and 2015. In this respect the bill is a welcome change. It is vital that the debate around authorisation, use, and oversight of such powers is fully informed and transparent.Unfortunately the bill says little about the nature of bulk data, or about how it is actually used. Furthermore, the Impact Assessment document published alongside the draft bill makes clear that the bill does not grant any new powers in relation to bulk data. Instead it puts already operational powers clearly into legislation, while strengthening the oversight framework and introducing some judicial control into the authorisation of bulk personal data. But an informed discussion about authorisation and oversight requires some understanding of the potential uses and abuses of bulk data in contemporary computer-based analytics. To contribute to that discussion, this paper seeks to explain the draft provisions of the bill affecting the use of bulk personal data, and to put these provisions into technological context.